Penetration Testing vs Vulnerability Scanning: What's the Difference?

Penetration testing vs vulnerability scanning comes down to depth. A vulnerability scan is an automated check of your systems against a database of known weaknesses. It is fast, broad and repeatable, and should run monthly or more often. A penetration test is a manual, time-boxed attack by a skilled tester who confirms which weaknesses are exploitable and chains them together to show real impact, usually once a year and after major change. They are not alternatives: you need both.

This guide compares the two side by side, explains what each finds, and sets out what PCI DSS, Cyber Essentials Plus and ISO 27001 expect. If you are new to scanning, start with our guide to what a vulnerability scan is and how scanning works.

Key takeaways

• Scanning finds known weaknesses at scale; penetration testing shows what those weaknesses allow.
• A scan cannot find business logic or access control flaws. A person has to test those.
• Scans run weekly to monthly; penetration tests run annually and after significant change.
• PCI DSS requires both: quarterly internal and ASV scans, and annual internal and external penetration tests.
• A “penetration test” priced like a scan is almost always a scan.
• Automated penetration testing tools sit in between: useful for frequent checks, but no substitute for a manual test.

Vulnerability scanning vs penetration testing: what is the difference?

The difference is who does the work and how deep it goes, as the table above shows. A scanner compares what it can see with a list of known issues. A tester thinks like an attacker, working out which issues matter in your environment and what they lead to. A vulnerability assessment sits between the two: an analyst validates and prioritises scan results, but stops short of exploiting them.

Is a vulnerability scan a penetration test?

No, and it is worth checking what you are buying. Some low-cost “penetration tests” are an automated scan with a report template. One UK provider’s pricing guide states that anything at £300 or less is not a penetration test, and at typical day rates of about £1,000 to £1,500 that price buys only a couple of hours of a tester’s time.

Ask any provider how many days of manual testing are included and what the tester will do in them. If the answer is vague, you are probably buying a scan.

Automated vs manual penetration testing: what is the difference?

Automated penetration testing uses software to run known checks and pre-built, safe exploits against your systems on a schedule, while manual penetration testing relies on a tester who adapts to what they find. Automated tools go further than a scanner because they try to use what they find, but they follow a script. A manual tester follows the evidence.

Automated testing is worth having between manual tests, especially on internal networks where the same weaknesses tend to come back. It is not a replacement for a manual test. PCI DSS v4.0.1 Requirement 11.4.1 expects application-layer testing to cover at least the attack types in Requirement 6.2.4, which include business logic and access control attacks, and a tool cannot judge those. If you plan to rely on an automated tool’s output for compliance, ask your assessor first.

What does each one find?

A vulnerability scan is good at finding:

• Missing security updates and end-of-life software.
• Weak configuration, such as outdated TLS settings or default services.
• Exposed services and ports that should not be reachable.
• Known vulnerable versions of web servers, frameworks and plugins.

A penetration test also finds:

• Chains of low and medium issues that together give serious access.
• Broken access control, such as one customer being able to read another’s records.
• Business logic flaws, such as skipping a payment step or manipulating a price.
• Weak credentials, password reuse and privilege escalation paths.
• Whether segmentation actually stops traffic reaching sensitive systems.

A scanner might report three medium findings on three servers. A tester can show that together they give an attacker administrative access. That context is what makes a penetration test useful to a board.

Does a penetration test find more than a vulnerability scan?

In practice, yes for the flaws that matter most in your own applications, and no for breadth. A scan can check thousands of hosts for missing patches in a few hours, which no tester can match. A penetration test finds the flaws a scanner cannot recognise, because they depend on what the application is meant to do.

Here is a simple, generic example. A customer portal lets users download invoices from an address such as /invoices/10482. A scanner requests the page, receives a valid PDF and reports nothing, because nothing looks broken. A tester logs in as two different customers, changes the number to one that belongs to the other account and receives the other customer’s invoice. That is broken access control, known as an insecure direct object reference (IDOR). It can expose every customer’s records, and it is invisible to a tool that does not know which invoice belongs to whom.

The same goes for a checkout that trusts a price sent from the browser, or a discount code that can be applied twice. Web application penetration testing is where flaws like these are normally found.

When do you need a scan, and when a penetration test?

If you want one provider to handle both, the combination is often sold as VAPT (vulnerability assessment and penetration testing). Whatever it is called, check how many of the days are manual testing.

How often should you run each?

A simple, defensible calendar for a mid-sized organisation:

• Weekly or continuous: external scanning of internet-facing systems.
• Monthly: authenticated internal scanning.
• Quarterly: ASV scans, if PCI DSS applies.
• Per major release or every six months: penetration testing of customer-facing applications and APIs.
• Annually and after significant change: internal and external infrastructure penetration tests.

Use scan results to shape each penetration test, so the tester’s time goes on the areas a scanner cannot assess. Our guide on how often penetration testing should be done covers the triggers for out-of-cycle tests.

What do PCI DSS, Cyber Essentials Plus and ISO 27001 require?

For PCI DSS, a passing ASV scan and a PCI penetration testing report are separate pieces of evidence, and your assessor will ask for both. Our guide on how to pass a PCI compliance scan covers the common reasons ASV scans fail. For certification, the Cyber Essentials Plus requirements explain exactly what the audit checks. For ISO, our page on ISO 27001 penetration testing sets out what auditors expect.

How do the costs compare?

Scanning is usually priced per asset or as an annual subscription, so each scan costs little. Penetration testing is priced by tester-days. In published prices from UK providers we reviewed in September 2026, small fixed-scope external tests started at about £550 and full multi-scope assessments ran to £25,000 or more. Our guide to penetration testing cost breaks this down by test type.

The cheapest programme is rarely the one with the fewest tests. Regular scanning keeps the obvious issues out of your penetration test report, so the tester’s days go on the flaws only a person can find.

How do you get value from a scanning programme?

• Scan what you own. Build scope from your asset inventory, cloud accounts and DNS records, and use discovery scans to catch what is missing.
• Authenticate. Credentialed scans are far more accurate than unauthenticated ones.
• Prioritise by real risk. Actively exploited vulnerabilities and internet-facing systems first, then by the value of the asset.
• Assign owners and dates. Every finding needs a named owner and a target fix date.
• Measure remediation, not scan counts. Track time to fix by severity and recurring findings.

Why Sovereign Secure

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. Our vulnerability scanning services cover internal, external and web application scanning with triage and reporting, and PCI external scans are delivered through a PCI SSC Approved Scanning Vendor partner.

Next step

If you are not sure whether you need a scan, a test or both, tell us what is driving the work. Our penetration testing services UK page lists every test we run, and our penetration testing quote form gets you a fixed price for the combination you need.